[PSA] Windows Defender caught LummaStealer behavior in official OpenAI Codex VSCode extension (v26.318.11754) — sharing for awareness

What version of the IDE extension are you using?

26.318.11754

What subscription do you have?

ChatGPT Business

Which IDE are you using?

Antigravity (VS Code fork, Open VSX Registry)

What platform is your computer?

Windows 11 Home Single Language, Version 25H2, Build 26200.8037, x64

What issue are you seeing?

TL;DR

After Antigravity IDE auto-updated the official openai.chatgpt extension to
version 26.318.11754 (March 20, 2026), Windows Defender caught
Behavior:Win32/LummaStealer.CI!MTB executing from inside the extension's
binary directory. Sharing for community awareness.

Environment

• IDE: Antigravity (VS Code fork, uses Open VSX Registry)
• Extension: Codex – OpenAI's coding agent (openai.chatgpt)
• Version: 26.318.11754 (auto-updated March 20, 2026 at 11:26 AM)
• OS: Windows 11

What happened

1. Antigravity auto-updated the Codex extension overnight
2. Next day (~March 21, 8:18 PM) I authenticated via the extension's

OAuth login flow — browser opened a login page, passed CAPTCHA, logged in normally

1. ~1 minute later Windows Defender fired twice:

Detected: Behavior:Win32/LummaStealer.CI!MTB
Status: Removed / Quarantined
Path: C:\Users\..\.antigravity\extensions\openai.chatgpt-26.318.11754-win32-x64\bin\windows-x86_64\codex.exe

What I did

• Defender blocked and quarantined both instances
• Revoked all active sessions (Google, OpenAI, exchanges)
• Changed passwords from a clean device
• Ran offline Defender scan — clean

Investigation results

• codex.exe — clean, 0/63 on VT, valid OpenAI/Microsoft signature

SHA256: b48b83282b8f31c13b0e27f882dbc101437f6e23a7eaa6e047ce794939b4e4da
VT: https://www.virustotal.com/gui/file/b48b83282b8f31c13b0e27f882dbc101437f6e23a7eaa6e047ce794939b4e4da

• rg.exe (ripgrep bundled in extension) — 1/72 on VT

Zillya: Trojan.GenKryptik.Win64.61413 — likely false positive on Rust binary
SHA256: decdd4992f3f1b9a5ef9898f1b40ab16886d579d6516b4efd3d5eaa19364e408
VT: https://www.virustotal.com/gui/file/decdd4992f3f1b9a5ef9898f1b40ab16886d579d6516b4efd3d5eaa19364e408

• .codex/.env and AGENTS.md — empty, no config injection found
• Root cause of Defender behavioral detection still unclear

Ask

• Has anyone else seen Defender alerts on openai.chatgpt version 26.318.11754?
• Can someone on the same version hash-check their codex.exe and rg.exe?
• Any idea why Defender would flag codex.exe with LummaStealer behavior

pattern on first OAuth login?

Reported to OpenAI Security: security@openai.com

<img width="1071" height="817" alt="Image" src="https://github.com/user-attachments/assets/c41c1a5a-b597-462b-93b1-599f7464425b" />

<img width="1083" height="688" alt="Image" src="https://github.com/user-attachments/assets/54b880cb-6850-49f5-8427-5a3956209126" />

<img width="1280" height="720" alt="Image" src="https://github.com/user-attachments/assets/f08e94d6-3c5a-402d-8ee8-fccfb1ca3b43" />

What steps can reproduce the bug?

1. Install openai.chatgpt extension version 26.318.11754 in Antigravity IDE
2. Click "Sign in" in the Codex panel
3. Complete OAuth login in browser (including CAPTCHA)
4. Return to IDE — Defender fires within ~60 seconds

What is the expected behavior?

No security alerts. codex.exe should run without triggering
LummaStealer behavioral detection in Windows Defender.

Additional information

• rg.exe in the same directory flagged 1/72 on VT (Zillya: Trojan.GenKryptik.Win64.61413)

SHA256: decdd4992f3f1b9a5ef9898f1b40ab16886d579d6516b4efd3d5eaa19364e408
VT: https://www.virustotal.com/gui/file/decdd4992f3f1b9a5ef9898f1b40ab16886d579d6516b4efd3d5eaa19364e408
This hash matches official ripgrep 15.1.0 x86_64-pc-windows-msvc — likely false positive on Rust binary.

• .codex/.env and AGENTS.md are empty — no config injection found
• Issue reproducible on both 26.318.11754 and 0.4.79
• Reported to security@openai.com